CVE-2026-102404
MEDIUM 6.5Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an out-of-memory condition that terminates the Elasticsearch node. The condition can be triggered repeatedly, including by queries embedded in shared resources, causing persistent cluster unavailability.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 24th percentile
Impact if exploited
6.5CVSS 3.1 · MEDIUM
- ConfidentialityNone
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-400: Uncontrolled Resource Consumption
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References and research data (JSON)
Vendor product assessments
rhoai/odh-feature-server-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected
Vendor assessment for this product only.
pkg:oci/odh-feature-server-rhel9?repository_url=registry.redhat.io/rhoai/odh-feature-server-rhel9
- workaround: Restrict network exposure by limiting access to the Elasticsearch service to trusted internal networks and authorized hosts using host-level firewalling or container network policies. On hosts utilizing firewalld, restrict traffic on the service port (TCP port 9200) to trusted IP addresses: firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_CIDR> firewall-cmd --permanent --remove-port=9200/tcp firewall-cmd --reload In OpenShift or Kubernetes environments, apply NetworkPolicies to restrict ingress traffic to the Elasticsearch pods, permitting communication only from trusted application namespaces. Additionally, restrict query execution privileges using role-based access control so that untrusted accounts cannot execute arbitrary queries. Caveats: Network filtering and access restrictions prevent untrusted network actors from submitting queries, but authenticated trusted accounts can still trigger the vulnerability. Reloading firewall rules or applying network policies may cause brief connection drops for active sessions.
- none available: Fix deferred
quay/quay-rhel8 as a component of Red Hat Quay 3 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:oci/quay-rhel8?repository_url=registry.redhat.io/quay/quay-rhel8
Red Hat · CVE-2026-102404 · Updated 2026-10-08T06:17:49+00:00quay/quay-rhel9 as a component of Red Hat Quay 3 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:oci/quay-rhel9?repository_url=registry.redhat.io/quay/quay-rhel9
Red Hat · CVE-2026-102404 · Updated 2026-10-08T06:17:49+00:00
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Elastic | Elasticsearch | ≥ 8.0.0 and < 8.19.23 |
| Elastic | Elasticsearch | ≥ 9.0.0 and < 9.4.8 |
| Elastic | Elasticsearch | ≥ 9.5.0 and < 9.5.5 |
All CVSS metrics
- MEDIUM 6.5 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - MEDIUM 6.5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
Advisories
- https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-185/390859 CVE record · elastic · Updated 2026-10-06T19:31:34.716Z
NVD · CVE-2026-102404 · Updated 2026-10-13T18:50:46.900
Red Hat · CVE-2026-102404 · Updated 2026-10-08T06:17:49+00:00 - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102404.json Red Hat · CVE-2026-102404 · Updated 2026-10-08T06:17:49+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93926 EUVD · EUVD-2026-93926
Technical & other
- https://access.redhat.com/security/cve/CVE-2026-102404 Red Hat · CVE-2026-102404 · Updated 2026-10-08T06:17:49+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2547107 Red Hat · CVE-2026-102404 · Updated 2026-10-08T06:17:49+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-102404 Red Hat · CVE-2026-102404 · Updated 2026-10-08T06:17:49+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-102404 Red Hat · CVE-2026-102404 · Updated 2026-10-08T06:17:49+00:00